Which problem does a multicontext firewall solve?
Which problem is solved by deploying a multicontext firewall?
Community Insight
The question tests whether you know multicontext ASA contexts are separate virtual firewalls with independent routing tables, not an HA feature; the trap is equating multiple contexts with resilient high availability.
Deploying a multicontext firewall on Cisco ASA creates multiple virtual firewalls, each with its own routing table, which solves overlapping IP addressing across contexts. The correct answer is A because overlapping subnets require separate routing domains, not faster inspection or an HA pair.
Many candidates choose B because multiple contexts sound like redundancy, but contexts share the physical appliance, so an appliance failure affects all of them; HA needs a separate failover pair.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A multicontext firewall creates multiple independent security contexts on one physical ASA, and each context maintains its own configuration, interfaces, policies, and routing table. Because routing is isolated per context, the same or overlapping private IP subnets can be reused in different contexts without conflict. Cisco's ASA data sheet explicitly describes per-context routing tables for static and dynamic routes, which is exactly what an overlapping IP addressing plan requires. Therefore, the problem solved by multicontext deployment is overlapping IP addressing, making A the correct answer.Why the Other Options Are Wrong
B is wrong because multicontext is not a high-availability design; all contexts share the same hardware and CPU/memory resources, so a physical appliance failure affects every context. Resilient HA requires a separate failover pair or redundant appliance, not merely multiple contexts on one device. C is wrong because contexts do not make inspection faster; they share the appliance's processing resources, so adding contexts can reduce per-context performance rather than improve it. D is wrong because although separate contexts can have separate policies, the primary problem being solved is routing/address isolation, not a vague claim of more secure policy.Community Comment Notes
klu16 simply agreed with the answer: "A indeed." Silexis compared multicontext to a VRF and noted that overlapping networks need different routing tables, while also pointing out that if the appliance fails, all contexts are affected unless an HA pair exists. XBfoundX cited Cisco's data sheet that each context can "maintain its own routing table" and argued that HA does not require multi-context and faster inspection is not the issue. Ernestokoro argued for B, but the stronger analysis is that contexts share one appliance and therefore do not by themselves provide resilient high availability.Official Reference
Exam Strategy
When you see multicontext firewall, think separate virtual firewalls with independent routing tables and policies, not redundancy. Eliminate HA answers unless the question explicitly mentions failover pairs or redundant appliances.
Frequently Asked Questions
Why doesn't a multicontext firewall provide high availability?
All contexts share one physical appliance, so a hardware failure affects every context; HA requires a separate failover pair or redundant appliance.
Can two ASA contexts use the same IP subnet?
Yes. Each context has its own routing table and virtual firewall instance, so overlapping address plans can be isolated across contexts.